list storage ACL via Service pricipal

Rakesh Prasad 0
Viewed 80

i want to run this API - Path(get - properties) but rather than using SAS, Access Key. I want to use AD based authentication. how to achieve that?

the signature that we sent via header currently looks like

'Authorization' : 'SharedKey {storage_account_name} : {signed_string}'

I have a reference of another article where they are talking about AD and storage. I have completed this step.

but after getting bearer token, how to use it to get ACL at storage level?

Setup:

After setting up application as following

enter image description here

I still got error while running it via Postman and Python code.

enter image description here

azure-rbac azure-storage azure-blob-storage
1 Answers

I tried to reproduce the same in my environment and got the below results

I registered one application in Azure AD and added API permissions for Azure Storage like below:

enter image description here

Make sure whether you have required permissions or not before running the query.

Now, I generated bearer token using ROPC flow with below parameters:

POST https://login.microsoftonline.com/tenantId/oauth2/v2.0/token

client_id : xxxxxx-xxx-xxx-xxxx-xxxxxxxx
grant_type : password
scope : https://storage.azure.com/user_impersonation
username : sri@********.onmicrosoft.com
password : ******
client_secret : ************

enter image description here

After getting the bearer token, I ran the same query as below and got ACL in x-ms-acl response header successfully:

HEAD https://<storageacc_name>.dfs.core.windows.net/testfile/path.txt?action=getAccessControl&upn=true

Authorization: Bearer <paste_bearer_token_here>
x-ms-version: 2021-06-08

Response:

enter image description here

Please note that, Authorization header must be Bearer <token> while using Azure AD based authentication.

usert0Id10
Related